The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability (Administrator by default) to store a payload that is executed in the browser of any administrator who later opens that page. As the unfilteredhtml capability is not available to administrators on multisite (or where DISALLOWUNFILTEREDHTML is set), this leads to Stored Cross-Site Scripting.